We evaluate our methods on the CIFAR-10 and the CIFAR-100 data sets [1]}, using a VGG-16 [2]} target architecture in both cases. For each correctly classified image we generate an adversarial counterpart, using the different attack methods. On all successfully attacked images (or feature-maps for the second method) and their non-adversarial counterpart, a Fourier transformation is applied, using two-dimensional discrete Fourier transformation (DFT). For both methods, we train a standard Logistic Regression on all extracted features to classify an image as adversarial or non-adversarial. We compare our approaches to two state-of-the-art detectors, the Local Intrinsic Dimensionality (LID) [3]} and the Mahalanobis Distance (M-D)[4]} detectors. For all five different attacks, our methods perform better on CIFAR-10 than the existing detectors. For CIFAR-100 we achieve better scores for three methods and similar scores for the other methods.
